d84965fbb96731f74a51fbfcdfaaed4da21c396e501dd47466fe58f58c2cf4cb

Analysis

max time kernel
137s
max time network
147s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 22:37

Target

b588fc95e949a6039a66bf6cdc8cdd1c_JaffaCakes118.exe
Size

9.0MB
MD5

b588fc95e949a6039a66bf6cdc8cdd1c
SHA1

6aab27f94dbd1e1e4180c3a067d0e5715dae752d
SHA256

d84965fbb96731f74a51fbfcdfaaed4da21c396e501dd47466fe58f58c2cf4cb
SHA512

9e84eea36f4e2d138a8cc1705073b86745006aff3ae0f62114da1fbb6f30ba067330cc93496a168a0d860063565680fb4b2dec65a63a794ab04564c254a7f59e
SSDEEP

196608:K0mXuX+JJW1Qh5NnlmXHYIXb0prqN1PIUWQupXrcBoMIB+IHJFDYR96/:K0m0+Jss3lmXHNXirqNLWQAbcBoMIB+i

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1968	2424ac5a-d7e6-465d-a080-a65a83ff230d.exe

Loads dropped DLL 1 IoCs

pid	Process
1708	b588fc95e949a6039a66bf6cdc8cdd1c_JaffaCakes118.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AAA9A07E-68FF-4215-84F2-96115976F786}\AccessPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000	2424ac5a-d7e6-465d-a080-a65a83ff230d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AAA9A07E-68FF-4215-84F2-96115976F786}	2424ac5a-d7e6-465d-a080-a65a83ff230d.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AAA9A07E-68FF-4215-84F2-96115976F786}\LaunchPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000	2424ac5a-d7e6-465d-a080-a65a83ff230d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1968	2424ac5a-d7e6-465d-a080-a65a83ff230d.exe
1968	2424ac5a-d7e6-465d-a080-a65a83ff230d.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2812	msiexec.exe
Token: SeTakeOwnershipPrivilege	2812	msiexec.exe
Token: SeSecurityPrivilege	2812	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1968	1708	b588fc95e949a6039a66bf6cdc8cdd1c_JaffaCakes118.exe	28
PID 1708 wrote to memory of 1968	1708	b588fc95e949a6039a66bf6cdc8cdd1c_JaffaCakes118.exe	28
PID 1708 wrote to memory of 1968	1708	b588fc95e949a6039a66bf6cdc8cdd1c_JaffaCakes118.exe	28
PID 1708 wrote to memory of 1968	1708	b588fc95e949a6039a66bf6cdc8cdd1c_JaffaCakes118.exe	28
PID 1708 wrote to memory of 1968	1708	b588fc95e949a6039a66bf6cdc8cdd1c_JaffaCakes118.exe	28
PID 1708 wrote to memory of 1968	1708	b588fc95e949a6039a66bf6cdc8cdd1c_JaffaCakes118.exe	28
PID 1708 wrote to memory of 1968	1708	b588fc95e949a6039a66bf6cdc8cdd1c_JaffaCakes118.exe	28

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2812

\Users\Admin\AppData\Local\Temp\2424ac5a-d7e6-465d-a080-a65a83ff230d.exe

Filesize
9.0MB

MD5
b588fc95e949a6039a66bf6cdc8cdd1c

SHA1
6aab27f94dbd1e1e4180c3a067d0e5715dae752d

SHA256
d84965fbb96731f74a51fbfcdfaaed4da21c396e501dd47466fe58f58c2cf4cb

SHA512
9e84eea36f4e2d138a8cc1705073b86745006aff3ae0f62114da1fbb6f30ba067330cc93496a168a0d860063565680fb4b2dec65a63a794ab04564c254a7f59e

Download Submit